Privacy policy

Updated 11 October 2026

CadFreely is a web app for viewing and editing CAD drawings. You can try the editor for five minutes, then continue drawing with a free account. Email and password, Google or Facebook sign-in is available where configured. Online storage and AI assistance have their own access limits. Recovery downloads remain available without signing in, and local drawing stays available while offline or when account services cannot be checked.

The editor stores a cumulative guest-use duration in this browser to remember the five-minute allowance across tabs and reloads. It counts time while the editor is visible and sign-in is available. This local access setting contains no visitor identifier and is not sent as an analytics event. It is separate from your optional usage-statistics choice.

Local drawings and browser storage

Your browser stores drawing recovery copies, recent-session information and drafting preferences on your device. The app restores your previous drawing tabs when recovery is available. Local Save uses your connected file when the browser supports it; otherwise you can download a copy.

DWG import can run in your browser. When server conversion or file export is used, the file or drawing data is sent to CadFreely's server for processing. Server import copies and conversion caches can remain available to your browser session for reopening files and loading block definitions. These processing copies are separate from drawings you deliberately save online.

Google sign-in

When you choose Google sign-in, CadFreely receives your Google account identifier, verified email address, name and profile-picture address. The server uses these details to identify your account, display your profile, restrict access to your online drawings and track AI usage. CadFreely does not receive your Google password or request access to your Gmail, Google Drive or contacts.

Email, passwords and linked accounts

When email sign-in is enabled, Google Firebase Authentication verifies email ownership, stores password credentials securely and sends verification and password-reset emails. Your password travels over HTTPS through CadFreely's server to Firebase; CadFreely does not store it in its account database or browser storage. CadFreely stores the verified account identifier, email, available sign-in methods and a private link to your existing CadFreely account. Connecting Google requires verified access, so linked methods use the same online drawings, AI allowance and permissions. Accounts are not merged merely because an unverified email matches.

Private sign-in cookies last up to seven days. Password recovery or disabling an account invalidates Firebase-backed CadFreely sessions, with revocation status cached for up to 30 seconds. Temporary abuse-prevention counters use hashed email and network identifiers and expire after their rate-limit window; database deletion can occur later. Firebase processes authentication under Google's Privacy Policy.

Facebook sign-in

When you choose Facebook sign-in, CadFreely receives your app-scoped Facebook identifier, name, profile-picture address and email address if Facebook provides it with your permission. These details identify your CadFreely account, display your profile and associate your online drawings and AI usage with that account. CadFreely does not request your Facebook password, friends, posts, pages or messages.

Facebook verifies your identity in its own window. CadFreely's server uses the resulting authorization code and access token to verify the app and user, then discards the access token. The token is not sent to the drawing app or saved in your account. Short-lived login states prevent replay; expiration stops a state from being used but does not guarantee immediate deletion of its stored record.

Google and Facebook are separate sign-in methods. CadFreely does not combine their accounts based on matching email addresses. Use the same method to return to your existing drawings and subscription. Facebook processes sign-in according to its Privacy Policy.

Sign-in and import-session cookies keep account access and import files associated with the correct browser. Signing out ends your CadFreely sign-in session; it does not delete your account or drawings.

Online storage

When you choose online storage, CadFreely's server stores your drawing content, its name, revision and save time under your account. Drawings are private unless you deliberately create a sharing link or authorize an integration. Local drawings are not automatically added to online storage when you sign in.

Drawing sharing

You can create Viewer, Editable or Full access links for saved online drawings. Anyone holding a link can use its permissions, including someone it is forwarded to. The interactive viewer sends drawing geometry to the recipient's browser for pan, zoom, dimension inspection and measurements. Viewer mode disables editing and object copying. Editable access requires sign-in and lets recipients save changes to your shared drawing and copy/paste objects between drawings, even when file downloads are disabled. Explicitly copied objects may be retained in the recipient's tab clipboard and cannot be recalled by closing a link. Full access also permits independent downloads and printing. Sharing is optional and links are excluded from our sitemap and marked not to be indexed.

CadFreely stores permission records, hashed link tokens, drawing previews and the account identifier responsible for the latest shared edit. Shared recipient pages keep their state in memory rather than creating automatic browser recovery copies. You can close a link to block future server access; open pages periodically check access. Closing a link cannot recall prior downloads, screenshots or data already received. Copy, download and print controls restrict the app's tools; they cannot prevent screenshots or deliberate extraction of geometry from an interactive viewer or editor.

AI assistance

When you submit an AI request, CadFreely sends your prompt and relevant command or drawing context through its server to OpenAI. Copilot starts with a drawing overview and can request relevant geometry, labels, attributes, units, layer and block names or areas in bounded batches. It does not upload all drawing objects by default. Command-line AI help uses the same conversation. Ordinary drawing commands do not automatically request AI assistance.

With eligible Basic or Pro access, you can attach a PNG, JPEG or WebP image to the AI conversation. The image is prepared on your device. Pressing Send shares a bounded copy, its filename, your prompt and relevant context through CadFreely to OpenAI. It is included with each message until you remove it, and saved with this chat on your device. The image also follows the private request-record policy below for completion and retry recovery. It is not automatically copied into developer feedback.

You can send a single AI result to our developer team with your rating and comments. This shares that request and reply, your account email and limited result details so we can reply within 48 hours. It does not enable automatic message sharing or include drawing files or images. These requests are owner-only and retained for 30 days.

PDF / Image to CAD reads your chosen file on your device. When you select Generate CAD preview, it sends a bounded image of the selected PDF page or picture, its filename and page number, your tracing instructions, scale and drawing-unit context to OpenAI through CadFreely. It does not send the entire PDF. The selected image is included in the short-lived request records used for completion and retry recovery; it is not copied into optional shared conversation feedback. Closing the tool keeps an unapplied preview in this tab. Inserting the trace adds native drawing objects, which follow your normal local or online drawing-save choices.

To continue batch requests and prevent duplicate charges, CadFreely keeps up to four recent AI request records per account in private server storage, including the supplied context and replies. Continuations expire after ten minutes; records are replaced by later requests rather than accumulating a full chat archive. Expiration ends access to a continuation but does not automatically delete its stored record. These records are separate from aggregate usage statistics.

When you choose Render to 3D, CadFreely sends a raster view of the selected objects, current drawing or AI preview, bounded drawing measurements and recent chat to OpenAI's image service. Visible attached pictures may be included in that view. The generated concept image is stored privately for recovery and download; up to two recent render results per account are kept and replaced by newer renders. The download recovery link expires after 24 hours; expiry does not guarantee immediate deletion of stored image data.

CadFreely records AI usage and quota information against your account. OpenAI requests are subject to its Privacy Policy and applicable API terms. CadFreely disables response storage on OpenAI text drafting requests. Image requests use the Images API. These settings are not a guarantee of zero provider retention. Only include information you want to share with the provider shown in the AI panel.

The Past chats tab stores conversation history, previews and results privately in this browser, separated by signed-in account. This is not cross-device chat synchronization. Clearing site data can remove this history.

Optional AI message sharing

“Help improve CadFreely” is preselected when the sharing notice is first shown in the AI panel and you have no saved preference. You can uncheck it there or in AI → Advanced. An existing choice to switch sharing off stays off. When enabled, future AI requests and text replies can be saved privately for the CadFreely owner to review. These records include your account email, a conversation reference, task category, selected AI model, plan, result or failure code, response time, credits and reported provider cost. They help us understand requested workflows and fix poor results; no extra AI generation is performed to create this log.

Feedback records do not copy drawing files, geometry pages, images, attachments, internal tool messages, authentication headers or server credentials. Messages and replies are limited to 4,000 characters each. Common credential patterns, links, emails and international phone numbers inside message text are masked automatically, but free text can still contain personal or confidential information that automatic filters do not recognize. Avoid sharing confidential details. Your account email is retained separately so the owner can identify reports from your account.

You can switch off sharing in AI → Advanced at any time; this stops future feedback collection without changing your AI allowance or access. Turning it on does not import earlier chats. Shared feedback is unavailable in the owner dashboard after 30 days and scheduled for automatic database deletion; physical deletion and existing hosting backups can persist beyond that time. Existing shared messages remain subject to this retention period when you opt out. Contact us below to request their earlier deletion. Aggregate usage statistics and the short-lived operational records needed to complete AI requests are separate from this optional feedback.

Optional ChatGPT connection

When you connect CadFreely in ChatGPT, you explicitly grant access to your CadFreely identity, credit balance and saved online drawing list. ChatGPT can request bounded summaries, measurements, object pages and native previews for the Selected objects or model View you choose. Local files are not shared automatically. Drawing text and visible attached pictures can be included in requested previews. CadFreely receives only the tool inputs sent by ChatGPT, not your entire ChatGPT conversation. OpenAI handles your ChatGPT conversation under its own terms and privacy policy.

Temporary proposals are private to your account. Unfinished proposals expire after 30 minutes; published review links expire after seven days. Hosted integration records carry automatic database expiry timestamps; removal may occur after access has expired. Credit receipts remain as part of usage accounting. Public client registrations and connection status are retained so reconnection and revocation work reliably. Access tokens last one hour and refresh credentials up to 30 days; stored credentials are hashed. Disconnecting in CadFreely connection settings immediately revokes the connection's credentials. It does not delete drawings, refund consumed credits, or remove information already shared with ChatGPT.

Notifications from CadFreely

The owner can publish announcements for signed-in clients. You can read them in Notifications and mark them as read. In-app popups wait while you are working in a drawing. Android system notifications are a separate, optional choice in Notifications; allowing analytics does not enable them.

If you enable Android notifications, we store your browser's push subscription and encryption keys linked to your account for up to 30 days, renewed while that choice remains active. Push providers route encrypted delivery identifiers; the app checks your current signed-in account before retrieving and showing the message. Turn off on this device revokes its subscription on our server. No drawings, filenames or coordinates are collected for notification delivery.

Announcements stop appearing within 30 days. Detailed delivery records expire a further 30 days later; a bounded index retains up to 100 announcement titles and messages until replaced by newer announcements. Read acknowledgements expire after 60 days; send-action receipts are retained for 90 days to prevent duplicate publication. Local popup and device preferences remain in browser storage until cleared. Push-service acceptance is not proof that a phone displayed or a person read a notification. Existing hosting backups and scheduled database cleanup may persist longer.

Optional account activity

Free AI requires sign-in. Each UTC calendar month includes 2 base credits + 4 for signing in = 6 AI drafting credits. Enabling optional account activity adds 4 extra credits each month (10 total), including for existing participants. Credits reset on the first of the month and do not roll over. Turning account activity off returns the monthly limit to 6; credits already used still count. Basic anonymous counts and anonymous browser statistics do not enable this account-linked bonus. Manual drawing tools work with either choice.

Consented activity now includes device category and browser family, drawing-creation counts, and import, AI and save failure categories. The owner sees visit summaries and day-one/day-seven retention, with accounts and guest browsers kept separate. A visit starts after 30 minutes without observed interaction; automatic account checks do not count. The first-observed timestamp remains while the account activity profile is active to recognise earlier visits; detailed activity remains bounded to 30 UTC days. No drawing contents or filenames are added.

A separate, initially off choice in Privacy & usage allows activity counts to be linked to your signed-in account ID, name and email. The CadFreely owner can see recorded visits, returns, active days, file opens, committed edits, completed DIST/AREA measurements, confirmed saves and prepared exports/plots. The browser reports whether a saved/exported drawing had just been edited; it never sends drawing contents, drawing identifiers, filenames, coordinates, command text or IP addresses for this feature. These reports are not shared with advertisers and do not affect your access to drawing tools. Allowing anonymous browser statistics does not enable account activity.

Reports cover the last 30 UTC calendar days including today and do not reconstruct earlier activity. Reporting is batched and can miss offline or interrupted work. Counts cannot establish drawing quality or physical printing. Your account-specific choice is kept in local storage. Turning it off stops this browser immediately, erases the stored activity profile and revokes existing activity-reporting tokens on other devices; an offline deletion must be retried. Cached owner reports can take up to two minutes to refresh. Expired activity is excluded from reports and removed when the profile is maintained; inactive profiles are scheduled for automatic database deletion after 30 days. Physical database cleanup and existing hosting backups can persist longer.

Usage statistics and bug reports

Basic drawing-operation counts run without an analytics cookie or an Enable click. While online, the editor reports only an allowed operation category, result, file-format category and destination category. These reports measure workspace starts, first useful actions, opens, saves, exports and failures. They omit browser and account identifiers, filenames, file paths, drawing contents, URLs and exact action timestamps. The request omits cookies and its referring page. The analytics store keeps daily aggregate counters rather than individual activity records, and the administrator can query up to 90 days. Older aggregate counters may remain until their bounded storage slot is reused. Existing hosting services still receive normal network-request information as described below.

These aggregate counts cannot identify a person, join actions into a personal history or measure return visits. Choosing Continue with basic counts leaves detailed analytics off. Previous browser or account refusals remain respected unless you explicitly turn basic counts on. You can turn basic counts off separately in Privacy & usage. Aggregate totals already recorded cannot be linked back to you or erased individually. Offline, blocked or lost reports are not replayed later; earlier missing activity cannot be reconstructed. A download result records dispatch to the browser, not proof that a file reached disk.

Consented guest activity uses the existing random browser cookie for a bounded 30-day timeline of visits, successful opens, creations, edits, measurements, saves and prepared exports, and import/AI/save failure counts. It includes only device category and browser family, not a fingerprint or IP address. Signed-in activity is excluded from guest activity timelines and requires the separate account choice. Known administrator/testing browsers and likely bots are labelled to exclude them from the ordinary overview. Earlier anonymous aggregate reports remain separate.

CadFreely records operational AI usage and quota information: AI model, task category, access, request outcome, credits, reported API cost and response time. These aggregate statistics exclude prompts, drawing content and filenames. Account identifiers are hashed for distinct-user counts; larger counts may be estimates.

Optional browser statistics start only when you allow them in Privacy & usage, also available from the app's account area and shared-drawing header. They count file opens, useful drawing actions, sharing, recipient-to-editor conversion and return visits. The server can confirm an active paid subscription during a measured visit; this is separate from authoritative billing records. We do not collect drawing geometry, filenames, comment text, share links, account IDs or browsing history in these browser statistics, and we do not send them to an advertising service.

After consent, first-party cookies named cad_growth and cad_insights may identify the browser for up to 30 days. Only purpose-specific hashes reach the statistics store. Growth profiles stop contributing after 30 days and are removed when their bounded storage bucket is maintained; dormant records and hosting backups can persist longer. Reports cover up to 90 days of anonymous cohort totals. Turning statistics off stops new reports and requests deletion of this browser's growth profile and cookies. A failed deletion can be retried from Privacy & usage. Existing aggregate counts remain. Clearing browser storage or changing devices can count as a different browser. Earlier activity is not backfilled.

If the owner enables client review on a sharing link, signed-in recipients may add comments, drawing-location pins, replies and revision-specific decisions. Account display names, timestamps and feedback are visible to the drawing owner and anyone with that same review link. Feedback is stored separately from native drawing geometry. Owners can resolve threads, disable review or close links; authors and owners can remove comment text. Earlier decisions keep their revision label and do not approve later revisions. Closing a link blocks future recipient access but does not erase retained review history. Contact us using the deletion instructions below for removal of retained reviews and backups.

If you choose Report a bug, your report text, issue category, mobile or desktop device type, sign-in status, app version and submission time are stored in the administrator inbox. A reply email is optional and is sent only with your permission. Drawings and screenshots are not attached automatically. Administrators can add private notes and track each report's status and history.

You can explicitly attach the current DWG or DXF and its report-time edits, or choose another DWG or DXF as an original-only attachment. This shares the selected file's name and full contents, which may include confidential text, geometry and attached drawing resources. Current-drawing reports include an untouched original, an edited recovery backup and an edited copy in the original file format when export succeeds. A failed export does not turn a recovery file into a DWG or DXF. Share only drawings you have permission to share. Opening files, enabling statistics or submitting a report without choosing an attachment does not enable this file sharing; earlier device-only files are not collected.

These troubleshooting files are stored privately and can be downloaded only through the separate authenticated administrator panel. Access expires after 30 days. Expired objects are removed when administrators load the report list; physical cleanup can be delayed by inactivity or storage failures, and existing hosting backups may persist longer. You can remove shared files from the report's success screen within 30 minutes of submitting it, or contact us below for later removal. Administrators can delete them without deleting the written report. Upload and storage limits can prevent attachments; an already submitted written report remains available even if an attachment fails.

The app also reports a limited number of technical failures automatically, including their category, app version, browser family, screen size and location within the app bundle. Exception messages, stack traces, page URLs, file names, chat content and drawing data are excluded from these automatic reports. Repeated failures are grouped for troubleshooting. A separate first-party cad_diagnostics cookie, lasting up to one day, helps limit duplicate reports and abuse; it is not used for optional growth statistics.

Hosting, retention and your choices

CadFreely uses Google Cloud hosting. Network requests provide the hosting service with technical information such as your IP address and browser request details. This information may appear in operational and error logs.

The private administrator Visits view reads existing hosting request logs for public CadFreely pages over a maximum 30-day query range, subject to hosting log availability. It shows request time, public page path, result, duration, broad browser/device type, a known referral service where supplied, likely automated requests and approximate network country. It groups requests using a temporary code derived from the hosting-recorded public IP address with a secret held only in server memory. This lets administrators count distinct network addresses and see which public pages each network requested, without connecting it to an account. The independently authenticated platform owner can also view the hosting-recorded public IP address; other administrators receive only the temporary network code. The code changes when the server process restarts and can differ across server instances. Shared networks, changing addresses and automated traffic mean these groups are not unique people or verified drawing sessions. Missing or invalid addresses remain ungrouped.

The Visits report excludes private sharing and authentication routes, query strings, raw browser identifiers, account details. Full IP addresses are restricted to the platform owner. Countries are resolved on our server using DB-IP Country Lite, licensed under CC BY 4.0; visitor addresses are not sent to DB-IP. Country can be inaccurate or unknown, particularly with VPNs and proxies, and does not identify a person's residence. Reports, including trusted public IP addresses, are kept in bounded server memory and become unavailable after five minutes; expired reports are removed on the next report request or when the server process ends. Administrators can extend a scan within a fixed limit; incomplete scans are labelled. This view adds no visitor cookie or tracking beacon, and does not change your optional browser-statistics choice. Offline or cached page opens may never reach the server. Existing hosting-log retention and backups are separate from this bounded view.

The owner can mark known tester IP addresses, account IDs or account emails as internal traffic. These private rules and a bounded change history are stored until changed; they classify reports without deleting operational logs or restricting access. IP rules affect everyone sharing the address. An optional owner-initiated network verification request uses a temporary random code and existing hosting logs to identify that connection; it does not track other browsers. Traffic without a matching rule or bot hint remains unclassified, not a verified person.

To protect online services from excessive requests, CadFreely also keeps a bounded recent activity log for the platform owner. It records the network address (or hosting proxy address where the visitor address cannot be verified), signed-in account ID/name/email when available, action category, online drawing ID and file format where available, AI model, request outcome, transferred byte counts and duration. It does not record drawing contents, prompts, authentication tokens or full file paths. The activity view covers up to 24 hours and at most 1,000 recent records. New activity is stored in small batches that become eligible for automatic deletion after their newest record reaches 24 hours; hosting-provider cleanup can be delayed. Older stored history is retained during migration but stops appearing after the same 24-hour window. This is not a promise of immediate physical deletion after 24 hours. The owner can temporarily restrict an account or a verified network address and review a bounded history of these decisions.

The owner's Usage view also summarizes this existing recent activity by signed-in account, showing recorded action categories, outcomes and last activity. This uses the same bounded operational records and does not collect extra actions or identify anonymous page visitors. Local drawing actions appear in a personal history only through optional activity reports. Basic drawing counts remain separate aggregate totals and cannot be joined to an account; offline reports are not queued for later delivery.

Request, processing and storage safeguards may temporarily pause online operations during excessive usage. Existing local drawings remain open. Online storage reservations include space for original sources and backups; they can exceed the size of the currently saved drawing.

Browser recovery data remains until you clear the site's stored data or the browser removes it. Clearing it can remove unsaved recovery copies and access to cached imports, so save needed files first. Account records and online drawings are stored on the server; this beta does not yet provide automatic account deletion or a fixed automatic deletion period for server import copies.

To request access to, correction of or deletion of data stored by CadFreely, contact eng.kareem.hesham@gmail.com. Include your sign-in method, CadFreely account name, account email if provided, and the relevant drawing name when applicable. We may need to verify that the request concerns your account. See the data deletion instructions. You can also manage CadFreely's connection in your Google Account settings or Facebook's Apps and Websites settings.